ערוך

Schedule security intelligence updates for Microsoft Defender for Endpoint on Linux

  • חל על: Microsoft Defender for Endpoint Plan 1, Microsoft Defender for Endpoint Plan 2

To run an update on Microsoft Defender for Endpoint on Linux, see Deploy updates for Microsoft Defender for Endpoint on Linux.

Linux and Unix have a tool called crontab (similar to Task Scheduler) to be able to run scheduled tasks.

Prerequisites

Note

To get a list of all the time zones, run the following command: timedatectl list-timezones

Examples for timezones:

  • America/Los_Angeles
  • America/New_York
  • America/Chicago
  • America/Denver

Set the cron job

Use the following commands:

Backup crontab entries

Use the following command to back up the current crontab entries before making changes:

sudo crontab -l > /var/tmp/cron_backup_201118.dat

Note

In our example, 201118 == YYMMDD.

Tip

Back up your crontab entries before you edit or remove them.

To edit the root user's crontab and add a new job:

sudo crontab -e

Note

The default editor is VIM.

You might see:

0 * * * * /etc/opt/microsoft/mdatp/logrorate.sh

And

0 2 * * sat /bin/mdatp scan quick>~/mdatp_cron_job.log

For instructions on creating a scheduled antivirus scan job, see Schedule scans with Microsoft Defender for Endpoint (Linux).

Press "Insert"

Add the following entries. Use the CRON_TZ setting to ensure the scheduled cron jobs run in the intended time zone:

CRON_TZ=America/Los_Angeles

#!RHEL and variants (CentOS and Oracle Linux)

0 6 * * sun [ $(date +\%d) -le 15 ] && sudo yum update mdatp -y >> ~/mdatp_cron_job.log

#!SLES and variants

0 6 * * sun [ $(date +\%d) -le 15 ] && sudo zypper update mdatp >> ~/mdatp_cron_job.log

#!Ubuntu and Debian systems

0 6 * * sun [ $(date +\%d) -le 15 ] && sudo apt-get install --only-upgrade mdatp >> ~/mdatp_cron_job.log

Note

In the RHEL, SLES, Ubuntu, and Debian cron entries, 0 6 * * sun specifies 00 minutes, 6 a.m. (hour using the 24-hour format), any day of the month, any month, on Sundays. [$(date +\%d) -le 15] doesn't run unless it's equal or less than the 15th day (third week). The full cron entry means the job runs at 6 a.m. every Sunday, but only if the day of the month is the 15th or earlier.

Press "Esc"

Type ":wq" w/o the double quotes.

Note

w == write, q == quit

To view your cron jobs, type sudo crontab -l

update Defender for Endpoint on Linux.

To verify that Defender-related cron jobs have run, search the cron log for mdatp entries:

sudo grep mdatp /var/log/cron

To open the log file and review output from scheduled Defender update tasks:

sudo nano mdatp_cron_job.log

Configure scheduled updates with Ansible, Chef, or Puppet

Use the following commands:

To set cron jobs in Ansible

Use Ansible's cron module to manage cron jobs:

cron - Manage cron.d and crontab entries

See https://docs.ansible.com/ansible/latest for more information.

To set crontabs in Chef

Use Chef's cron resource to manage cron jobs:

cron resource

See https://docs.chef.io/resources/cron/ for more information.

To set cron jobs in Puppet

Resource Type: cron

See https://puppet.com/docs/puppet/5.5/types/cron.html for more information.

Automating with Puppet: Cron jobs and scheduled tasks

See https://puppet.com/blog/automating-puppet-cron-jobs-and-scheduled-tasks/ for more information.

Common crontab commands and examples

The following commands cover common crontab tasks such as listing, backing up, editing, and removing cron entries.

To get help with crontab

Run the following command to view the crontab manual page:

man crontab

To get a list of crontab file of the current user

Run the following command to list the current user's crontab entries:

crontab -l

To get a list of crontab file of another user

Run the following command to list another user's crontab entries:

crontab -u username -l

To back up crontab entries

Use the following command to back up the current crontab entries:

crontab -l > /var/tmp/cron_backup.dat

Tip

Do this before you edit or remove.

To restore crontab entries

Run the following command to restore crontab entries from a backup file:

crontab /var/tmp/cron_backup.dat

To edit the crontab and add a new job as a root user

Use the following command to edit the root user's crontab and add a new job:

sudo crontab -e

To edit the crontab and add a new job

Run the following command to edit the current user's crontab and add a new job:

crontab -e

To edit other user's crontab entries

Run the following command to edit another user's crontab entries:

crontab -u username -e

To remove all crontab entries

Warning

This command removes all crontab entries for the current user without prompting for confirmation. Back up your crontab first with crontab -l > /var/tmp/cron_backup.dat if you might need to restore it.

Use the following command to remove all crontab entries for the current user:

crontab -r

To remove other user's crontab entries

Warning

This command permanently removes all crontab entries for the specified user without prompting for confirmation. Back up the user's crontab before running this command.

Use the following command to remove all scheduled tasks for a specific user by deleting that user's crontab entries:

crontab -u username -r

Cron expression field reference

The following diagram explains the fields in a cron expression:

+—————- minute (values: 0 - 59) (special characters: , - * /)  

| +————- hour (values: 0 - 23) (special characters: , - * /) 

| | +———- day of month (values: 1 - 31) (special characters: , - * / L W C)  

| | | +——- month (values: 1 - 12) (special characters: ,- * / )  

| | | | +—- day of week (values: 0 - 6) (Sunday=0 or 7) (special characters: , - * / L W C) 

| | | | |*****command to be executed
  • Last updated on